On guard where Switzerland shops
From ETH to Migros: discover the scenarios that Marc Himmelberger, a former Excellence Scholar in computer science, is anticipating at Switzerland’s largest employer.
“Does Migros even do IT?” That was the rather naïve question Marc Himmelberger asked a few years ago, stopping at a stand where the orange giant was presenting itself as a potential employer to computer science students at ETH Zurich. He now smiles at the memory.
Sitting in his office at Zurich’s Limmatplatz, he recalls his start at Migros where terms like “ROI”, “TCO” or “agile software development” were still unfamiliar. “At ETH, you learn the fundamentals – knowledge that will last you a while. On the flip side, you’re not aware of the latest in things like software development methodologies.” Nevertheless, he quickly settled into the team. His manager is an ETH graduate, as is his manager’s manager – and the one above him, too. “There are around 100 people working in cybersecurity here, and I’d say more than a dozen are ETH graduates.”
“What makes the job at Migros so interesting is the range of threat scenarios we’re working to prevent – many of which would have a real impact on Switzerland. Just think: what would happen if you suddenly couldn’t pay at the checkout? Or if the logistics systems went down and Migros lorries couldn’t get goods to stores on time?” As a retailer, Migros is part of Switzerland’s critical infrastructure, which means there’s a strong public interest in keeping its IT systems stable and secure.
From gaming to programming
Marc Himmelberger’s fascination with computer science came from his mother, who spent many years working in the sector. “Without her, I probably wouldn’t have thought to install a Java development environment on my PC at 13,” he says. He also spent a lot of time gaming. But what ultimately drew him to cryptography was the mathematics behind it. “Cryptography is incredibly precise and logical, but also very fragile. If even one single cog is out of place, the whole system falls apart. I find that fascinating.” This made him all the more grateful to receive an Excellence Scholarship for his Master’s studies: “That recognition gave me the freedom to focus fully on my studies – and led to a lot of inspiring contacts and connections.”
© ETH Foundation / Valeriano Di Domenico
“Organisations should switch to the most secure algorithms as early as possible.”
Thinking ahead pays off
Cybersecurity covers a wide range of job profiles. Some analysts work on a reactive basis, monitoring servers and laptops and responding to suspicious activity. “Like a fire brigade,” as Himmelberger puts it. By contrast, his role as an Enterprise Security Architect is preventative. He examines new IT initiatives – linking systems, new ways of analysing data or the use of artificial intelligence – through a security lens, makes recommendations and reviews how these are implemented at the end of a project. This is how he and his team ensure that all kinds of valuable data – customer data, industry information, digital signatures and even closely guarded recipes – remain protected.
But how much security is actually possible? How safe will we be when it comes to future new technologies – including quantum computing, that could prove game-changing across many fields, as well as cryptography and, subsequently, cybersecurity? During his first two years at Migros, Himmelberger focused closely on “quantum safety”, also known as “post-quantum cryptography”, a topic he had already explored in his Bachelor’s and Master’s theses at ETH: “We wanted to raise awareness among staff at an early stage, so that in future projects everyone understands what ‘quantum-safe’ means and where we want to go with it.”
As he explains: “‘Store now, decrypt later’ is a strategy used in cybercrime. The idea is to collect data now, even if it’s still securely encrypted. Once sufficiently powerful quantum computers exist, that data can be decrypted.” This, he argues, is precisely why it’s not a sound security strategy to assume it will be years before quantum computing becomes a reality. “We should move to the most secure algorithms as early as possible. The earlier an organisation makes the switch, the older the data that could potentially be exposed later.”
Beyond the screen
Not all of Himmelberger’s work happens behind a desk. During an internal training programme, he once stocked shelves in store: “This kind of insight really matters. It makes us security experts think from the user’s perspective. We learn, for example, that store staff can’t always log in using multifactor authentication because they don’t always have their phone on them. You need to understand that to come up with workable solutions.”
He also makes sure to spend screen-free time himself. Every other Saturday, he heads into the woods as co-leader of a Scout group. “It’s an excellent balance to office life.”
Success of the Excellence Scholarships
2007 (launch of the programme) to 2025:
- 807 outstanding students from 74 countries received support
- 249 from Switzerland and 336 from the rest of Europe
